CVE-2026-3911 | BDVDB-2026-319847 Detail
Red HatRed Hat build of Keycloak 26.4
Description#
A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized information disclosure could expose sensitive user data.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.